CVE-2026-41682: pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion
Published May 8, 2026
·Updated
pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi() cast in parseuri(). This issue has been patched in version 1.18.5.
Affected Software
1 affected component
pupnp pupnp<1.18.5
Event History
May 8, 2026
CVE Published
via MITRE·10:47 PM
Data Sourced
via MITRE·10:47 PM
DescriptionWeakness
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-41682?
CVE-2026-41682 has a high severity due to its potential to enable Server-Side Request Forgery (SSRF) attacks.
2
How do I fix CVE-2026-41682?
To fix CVE-2026-41682, upgrade to pupnp version 1.18.5 or later.
3
What systems are affected by CVE-2026-41682?
CVE-2026-41682 affects the pupnp SDK versions prior to 1.18.5.
4
What type of vulnerability is CVE-2026-41682?
CVE-2026-41682 is a Server-Side Request Forgery (SSRF) vulnerability caused by port truncation via atoi() in parse_uri().
5
Can CVE-2026-41682 be exploited remotely?
Yes, CVE-2026-41682 can be exploited remotely due to the nature of SSRF vulnerabilities.